Merge ~jslarraz/review-tools:schema-add-layout into review-tools:master

[Jorge Sancho Larraz]

many: validate snap.yaml::layout via schema

[Jorge Sancho Larraz (jslarraz)]

reviewtools/tests/schemas/test_schema_against_store.py validates the current snap.yaml schema against all snaps in the store. No additional errors have been found in this version.

[Jorge Sancho Larraz (jslarraz)]

See inline comments

[Alex Murray (alexmurray)]

LGTM!

review: Approve

[Jorge Sancho Larraz (jslarraz)]

Current tests cases have a 100% coverage. Thus, passing all the existent cases indicates that the regular expression is fine

See https://gist.github.com/jslarraz/9042092c83160a10af0985af716a382d

diff --git a/check-names.list b/check-names.list
index 5725ecf..687f33f 100644
--- a/check-names.list
+++ b/check-names.list
@@ -90,9 +90,6 @@ lint-snap-v2:icon_theme_size|
 lint-snap-v2:iffy_files|
 lint-snap-v2:install-mode|
 lint-snap-v2:invalid_link|
-lint-snap-v2:layout_source|
-lint-snap-v2:layout_target|
-lint-snap-v2:layout|
 lint-snap-v2:meta_gui_desktop|
 lint-snap-v2:mpris_slot_name|
 lint-snap-v2:personal-files_attrib_valid|
diff --git a/reviewtools/schemas/snap.json b/reviewtools/schemas/snap.json
index e8038b0..d45ddbf 100644
--- a/reviewtools/schemas/snap.json
+++ b/reviewtools/schemas/snap.json
@@ -89,6 +89,63 @@
         }
       },
       "additionalProperties": false
+    },
+    "layout": {
+      "description": "Modify the execution environment of a strictly-confined snap.",
+      "$comment": "See https://forum.snapcraft.io/t/why-are-snap-layouts-limited-to-15-entries/15337/3",
+      "type": "object",
+      "propertyNames": {
+        "not": {
+          "anyOf": [
+            {"pattern": "^/boot"},
+            {"pattern": "^/dev"},
+            {"pattern": "^/home"},
+            {"pattern": "^(/usr)?/lib/firmware"},
+            {"pattern": "^(/usr)?/lib/modules"},
+            {"pattern": "^/lost+found"},
+            {"pattern": "^/media"},
+            {"pattern": "^/proc"},
+            {"pattern": "^(/var)?/run"},
+            {"pattern": "^/sys"},
+            {"pattern": "^/tmp"},
+            {"pattern": "^/var/lib/snapd"},
+            {"pattern": "^/var/snap"}
+          ]
+        }
+      },
+      "patternProperties": {
+        "^(?:\\$(?:SNAP|SNAP_COMMON|SNAP_DATA))?(\\/(?![\\.]*\\/)[^\\/\\0]*)*[\\/]?$": {
+          "$comment": "The core of this regex, (\\/[^\\/\\0]*)*, is intended to match groups of (slash + file name), where file name does not contain slash or NULL characters. The negative lookahead (?![\\.]*\\/) is used to ensure that at least one character other than dots is present between two consecutive slashes, thus avoiding non-normalized paths but still allowing hidden files. Optionally the path may start with $SNAP, $SNAP_COMMON or $SNAP_DATA and may have a tailing slash",
+          "type": "object",
+          "patternProperties": {
+            "^bind|bind-file|symlink$": {
+              "type": "string",
+              "$comment": "This regex is identical to the previous one with the exception that it always must start with $SNAP, $SNAP_COMMON or $SNAP_DATA",
+              "pattern": "^\\$(SNAP|SNAP_COMMON|SNAP_DATA)(\\/(?![\\.]*\\/)[^\\/\\0]*)*[\\/]?$"
+            },
+            "^mode$": {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 511
+            },
+            "^type$": {
+              "type": "string",
+              "enum": ["tmpfs"]
+            },
+            "^user|group$": {
+              "type": "string",
+              "not": {
+                "pattern": "^[0-9]+$"
+              }
+            }
+          },
+          "minProperties": 1,
+          "additionalProperties": false
+        }
+      },
+      "minProperties": 1,
+      "maxProperties": 100,
+      "additionalProperties": false
     }
   },
   "required": ["name", "version"]
diff --git a/reviewtools/sr_lint.py b/reviewtools/sr_lint.py
index 8cad5e9..72d6691 100644
--- a/reviewtools/sr_lint.py
+++ b/reviewtools/sr_lint.py
@@ -2360,212 +2360,6 @@ class SnapReviewLint(SnapReview):
                     s = "paths found in both read and write: %s" % ", ".join(both)
                     self._add_result(t, n, s)
 
-    def check_layout(self):
-        """Check layout"""
-        if "layout" not in self.snap_yaml:
-            return
-
-        # snap/validate.go - ValidateLayout()
-        snap_vars = ["$SNAP", "$SNAP_COMMON", "$SNAP_DATA"]
-        target_bad_prefixes = [
-            "/boot",
-            "/dev",
-            "/home",
-            "(/usr)?/lib/firmware",
-            "(/usr)?/lib/modules",
-            "/lost+found",
-            "/media",
-            "/proc",
-            "(/var)?/run",
-            "/sys",
-            "/tmp",
-            "/var/lib/snapd",
-            "/var/snap",
-        ]
-
-        def _verify_layout_target(p, disallowed):
-            if "\0" in p or os.path.normpath(p) != p:
-                return False
-
-            # if the normalized path starts with snap_vars, then it is ok
-            for prefix in snap_vars:
-                if p.startswith("%s/" % prefix):
-                    return True
-
-            # otherwise it must be an absolute path
-            if not p.startswith("/"):
-                return False
-
-            # p is now guaranteed to start with '/' and not '//...'
-            for dis in disallowed:
-                if re.match(dis, p):
-                    return False
-
-            return True
-
-        def _verify_layout_source(p, allowed):
-            if "\0" in p or os.path.normpath(p) != p or not p.startswith("$"):
-                return False
-
-            # p is guaranteed to start with '$'
-            top = p.split("/")[0]
-            if top not in allowed:
-                return False
-
-            return True
-
-        # arbitrary; 10 was agreed upon with snapd team (zyga) but found snaps
-        # with 8, so bumped to 15. Unfortunately, others hit the ceiling, so
-        # bumping to 30, then bumped to 100 since surely 100 layouts is enough
-        # for anyone ;)
-        # https://forum.snapcraft.io/t/why-are-snap-layouts-limited-to-15-entries/15337/3
-        maximum_layouts = 100
-
-        key = "layout"
-        t = "info"
-        n = self._get_check_name(key)
-        s = "OK"
-        if not isinstance(self.snap_yaml[key], dict):
-            t = "error"
-            s = "invalid %s entry: %s (not a dict)" % (key, self.snap_yaml[key])
-            self._add_result(t, n, s)
-            return
-        elif len(self.snap_yaml[key].keys()) < 1:
-            t = "error"
-            s = "invalid %s entry (empty)" % (key)
-            self._add_result(t, n, s)
-            return
-        elif len(self.snap_yaml[key].keys()) > maximum_layouts:
-            t = "error"
-            s = "too many defined layouts (%d > %d)" % (
-                len(self.snap_yaml[key].keys()),
-                maximum_layouts,
-            )
-            self._add_result(t, n, s)
-            return
-        self._add_result(t, n, s)
-
-        for target in self.snap_yaml[key]:
-            t = "info"
-            n = self._get_check_name("%s_target" % key, app=target)
-            s = "OK"
-
-            if not isinstance(self.snap_yaml[key][target], dict):
-                t = "error"
-                s = "invalid entry: %s (not a dict)" % (self.snap_yaml[key][target])
-                self._add_result(t, n, s)
-                continue
-            elif len(self.snap_yaml[key][target].keys()) < 1:
-                t = "error"
-                s = "invalid target '%s' (empty)" % (target)
-                self._add_result(t, n, s)
-                continue
-            elif not _verify_layout_target(target, target_bad_prefixes):
-                t = "error"
-                s = (
-                    "invalid mount target: '%s'" % target
-                    + " (should be "
-                    + "a legal path (ie, absolute path or one that starts "
-                    + "with: %s)" % ", ".join(snap_vars)
-                    + ". If absolute, "
-                    + "should not start with: %s" % ", ".join(target_bad_prefixes)
-                )
-                self._add_result(t, n, s)
-                continue
-            self._add_result(t, n, s)
-
-            # from snap/info_snap.go
-            known = ["bind", "bind-file", "symlink", "type", "user", "group", "mode"]
-            for ltype in self.snap_yaml[key][target]:
-                t = "info"
-                n = self._get_check_name("%s" % key, app=target, extra=ltype)
-                s = "OK"
-
-                if ltype not in known:
-                    t = "error"
-                    s = "invalid layout: '%s' (should be one of %s)" % (
-                        ltype,
-                        ", ".join(known),
-                    )
-                    self._add_result(t, n, s)
-                    continue
-
-                if ltype in ["bind", "bind-file", "symlink"]:
-                    target = target
-                    source = self.snap_yaml[key][target][ltype]
-                    t = "info"
-                    n = self._get_check_name(
-                        "%s_source" % key, app=target, extra=source
-                    )
-                    s = "OK"
-
-                    if not isinstance(source, str):
-                        t = "error"
-                        s = "invalid source: %s (not a str)" % source
-                    elif not _verify_layout_source(source, snap_vars):
-                        t = "error"
-                        s = (
-                            "invalid source mount: '%s' " % source
-                            + "(should be a legal path and start with one "
-                            + "of: %s" % ", ".join(snap_vars)
-                        )
-                elif ltype == "mode":
-                    ltype = "mode"
-                    rdata = self.snap_yaml[key][target][ltype]
-                    if not isinstance(rdata, int) and not isinstance(rdata, str):
-                        t = "error"
-                        s = "invalid mode: should be an integer (eg, 0755)"
-                        self._add_result(t, n, s)
-                        continue
-
-                    mode = None
-                    if isinstance(rdata, str):
-                        try:
-                            mode = int(rdata, 8)
-                        except Exception:
-                            t = "error"
-                            s = (
-                                "mode '%s' should be an integer " % rdata
-                                + "within 1-777 octal"
-                            )
-                            self._add_result(t, n, s)
-                            continue
-                    else:
-                        mode = rdata
-
-                    if mode < 0o1 or mode > 0o777:
-                        t = "error"
-                        s = "mode '%s' must be within 1-777 octal" % format(mode, "o")
-                elif ltype == "type":
-                    ltype = "type"
-                    rdata = self.snap_yaml[key][target][ltype]
-                    if not isinstance(rdata, str):
-                        t = "error"
-                        s = "invalid %s (not a str)" % ltype
-                        self._add_result(t, n, s)
-                        continue
-
-                    if rdata != "tmpfs":
-                        t = "error"
-                        s = "invalid type: %s != tmpfs" % rdata
-                elif ltype in ["user", "group"]:
-                    rdata = self.snap_yaml[key][target][ltype]
-                    if not isinstance(rdata, str):
-                        t = "error"
-                        s = "invalid %s (not a str)" % ltype
-                        self._add_result(t, n, s)
-                        continue
-
-                    # Don't allow specifying uids
-                    try:
-                        int(self.snap_yaml[key][target][ltype])
-                        t = "error"
-                        s = "invalid %s (should not be a number)" % ltype
-                    except Exception:
-                        pass
-
-                self._add_result(t, n, s)
-
     def check_apps_install_mode(self):
         """Check apps - install-mode"""
         if "apps" not in self.snap_yaml:
diff --git a/reviewtools/tests/schemas/test_schema_snap.py b/reviewtools/tests/schemas/test_schema_snap.py
index beed77e..96484d3 100644
--- a/reviewtools/tests/schemas/test_schema_snap.py
+++ b/reviewtools/tests/schemas/test_schema_snap.py
@@ -354,3 +354,126 @@ class TestSchemaSnap(TestSchemaBase):
             with self.subTest(value=value):
                 error = error.replace("{value}", str(value)) if error else error
                 self._test_value("environment", value, error)
+
+    def test_layout(self):
+        for value, error in [
+            #  test_check_layout
+            (
+                {
+                    "/etc/demo": {"bind": "$SNAP_COMMON/etc/demo"},
+                    "/etc/demo.cfg": {"symlink": "$SNAP_COMMON/etc/demo.conf"},
+                    "/etc/demo.conf": {"bind-file": "$SNAP_COMMON/etc/demo.conf"},
+                    "/opt/demo": {"bind": "$SNAP/opt/demo"},
+                    "/usr/share/demo": {"bind": "$SNAP/usr/share/demo"},
+                    "/var/cache/demo": {"bind": "$SNAP_DATA/var/cache/demo"},
+                    "/var/lib/demo": {"bind": "$SNAP_DATA/var/lib/demo"},
+                    "/var/lib/foo": {"type": "tmpfs", "mode": 0o755},
+                    "/var/lib/bar": {
+                        "type": "tmpfs",
+                        "user": "username",
+                        "group": "groupname",
+                        "mode": 0o755,
+                    },
+                },
+                None,
+            ),
+            # test_check_layout_bad - list
+            ([], "{value} is not of type 'object'"),
+            # test_check_layout_empty
+            ({}, "{value} does not have enough properties"),
+            # test_check_layout_source_target_use_snap_vars - source/target use $SNAP
+            ({"$SNAP/db": {"bind": "$SNAP_DATA/db"}}, None),
+            # test_check_layout_target_bad_snap_var - bad target (SNAP_USER_COMMON)
+            (
+                {"$SNAP_USER_COMMON/db": {"bind": "$SNAP_DATA/db"}},
+                "'$SNAP_USER_COMMON/db' does not match ",
+            ),
+            # test_check_layout_target_bad_val - bad target (list)
+            ({"/etc/demo": []}, "[] is not of type 'object'"),
+            # test_check_layout_target_bad_empty
+            ({"/etc/demo": {}}, "{} does not have enough properties"),
+            # test_check_layout_target_bad_too_many
+            (
+                dict.fromkeys(["/a/%s" % i for i in range(101)], {"bind": "$SNAP/db"}),
+                "{value} has too many properties",
+            ),
+            # test_check_layout_target_bad - bad target (normpath)
+            (
+                {"/etc/../demo": {"bind": "$SNAP_COMMON/etc/demo"}},
+                "'/etc/../demo' does not match ",
+            ),
+            # test_check_layout_target_bad_prefix - bad target (prefix)
+            (
+                {"/proc/cmdline": {"bind": "$SNAP_COMMON/etc/demo"}},
+                " is not allowed for '/proc/cmdline'",
+            ),
+            (
+                {"/lib/firmware/foo": {"bind": "$SNAP_COMMON/etc/demo"}},
+                "is not allowed for '/lib/firmware/foo'",
+            ),
+            (
+                {"/usr/lib/firmware": {"bind": "$SNAP_COMMON/etc/demo"}},
+                "is not allowed for '/usr/lib/firmware'",
+            ),
+            (
+                {"/run": {"bind": "$SNAP_COMMON/etc/demo"}},
+                "is not allowed for '/run'",
+            ),
+            (
+                {"/var/run": {"bind": "$SNAP_COMMON/etc/demo"}},
+                "is not allowed for '/var/run'",
+            ),
+            # test_check_layout_source_bad_prefix - bad source (prefix)
+            (
+                {"/etc/demo": {"bind": "/bad/etc/demo"}},
+                "'/bad/etc/demo' does not match ",
+            ),
+            # test_check_layout_source_bad_prefix_home - bad source (prefix $HOME)
+            (
+                {"/var/tmp/other": {"bind": "$HOME/snap/other"}},
+                "'$HOME/snap/other' does not match ",
+            ),
+            # test_check_layout_source_bad_val - bad source (list)
+            ({"/etc/demo": {"bind": []}}, "[] is not of type 'string'"),
+            # test_check_layout_source_bad - bad source (normpath)
+            (
+                {"/etc/demo": {"bind": "$SNAP_COMMON/etc/../demo"}},
+                "'$SNAP_COMMON/etc/../demo' does not match",
+            ),
+            # test_check_layout_source_bad_type - bad source (type)
+            (
+                {"/etc/demo": {"nonexistent": "$SNAP_COMMON/etc/demo"}},
+                "'nonexistent' does not match any of the regexes: ",
+            ),
+            # test_check_layout_mode_bad
+            (
+                {"/var/lib/foo": {"type": "tmpfs", "mode": []}},
+                "[] is not of type 'integer'",
+            ),
+            # test_check_layout_mode_range - mode range TODO: can we limit it to integers? why no 0?
+            (
+                {"/var/lib/foo": {"type": "tmpfs", "mode": 0}},
+                "0 is less than the minimum of 1",
+            ),
+            (
+                {"/var/lib/foo": {"type": "tmpfs", "mode": 512}},
+                "512 is greater than the maximum of 511",
+            ),
+            (
+                {"/var/lib/foo": {"type": "tmpfs", "mode": "778"}},
+                "'778' is not of type 'integer'",
+            ),
+            # test_check_layout_type_bad
+            ({"/var/lib/foo": {"type": []}}, "[] is not of type 'string'"),
+            # test_check_layout_type_nonexistent
+            ({"/var/lib/foo": {"type": "nonexistent"}}, "'nonexistent' is not one of "),
+            # test_check_layout_user_bad
+            ({"/var/lib/foo": {"user": []}}, "[] is not of type 'string'"),
+            # test_check_layout_user_invalid
+            ({"/var/lib/foo": {"user": "0"}}, " is not allowed for '0'"),
+            # test_check_layout_group_bad
+            ({"/var/lib/foo": {"group": []}}, "[] is not of type 'string'"),
+        ]:
+            with self.subTest(value=value):
+                error = error.replace("{value}", str(value)) if error else error
+                self._test_value("layout", value, error)
diff --git a/reviewtools/tests/test_sr_lint.py b/reviewtools/tests/test_sr_lint.py
index 44f88df..14d0a54 100644
--- a/reviewtools/tests/test_sr_lint.py
+++ b/reviewtools/tests/test_sr_lint.py
@@ -4448,352 +4448,6 @@ class TestSnapReviewLint(sr_tests.TestSnapReview):
         expected_counts = {"info": None, "warn": 0, "error": 1}
         self.check_results(r, expected_counts)
 
-    def test_check_layout(self):
-        """Test check_layout()"""
-        self.set_test_snap_yaml(
-            "layout",
-            {
-                "/etc/demo": {"bind": "$SNAP_COMMON/etc/demo"},
-                "/etc/demo.cfg": {"symlink": "$SNAP_COMMON/etc/demo.conf"},
-                "/etc/demo.conf": {"bind-file": "$SNAP_COMMON/etc/demo.conf"},
-                "/opt/demo": {"bind": "$SNAP/opt/demo"},
-                "/usr/share/demo": {"bind": "$SNAP/usr/share/demo"},
-                "/var/cache/demo": {"bind": "$SNAP_DATA/var/cache/demo"},
-                "/var/lib/demo": {"bind": "$SNAP_DATA/var/lib/demo"},
-                "/var/lib/foo": {"type": "tmpfs", "mode": "755"},
-                "/var/lib/bar": {
-                    "type": "tmpfs",
-                    "user": "username",
-                    "group": "groupname",
-                    "mode": "0755",
-                },
-            },
-        )
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": 23, "warn": 0, "error": 0}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_bad(self):
-        """Test check_layout() - bad (list)"""
-        self.set_test_snap_yaml("layout", [])
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_empty(self):
-        """Test check_layout() - bad (empty)"""
-        self.set_test_snap_yaml("layout", {})
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_source_target_use_snap_vars(self):
-        """Test check_layout() - source/target use $SNAP..."""
-        self.set_test_snap_yaml("layout", {"$SNAP/db": {"bind": "$SNAP_DATA/db"}})
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": 3, "warn": 0, "error": 0}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_target_bad_snap_var(self):
-        """Test check_layout() - bad target (SNAP_USER_COMMON)"""
-        self.set_test_snap_yaml(
-            "layout", {"$SNAP_USER_COMMON/db": {"bind": "$SNAP_DATA/db"}}
-        )
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_target_bad_val(self):
-        """Test check_layout() - bad target (list)"""
-        self.set_test_snap_yaml("layout", {"/etc/demo": []})
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_target_bad_empty(self):
-        """Test check_layout() - bad target (empty)"""
-        self.set_test_snap_yaml("layout", {"/etc/demo": {}})
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_target_bad_too_many(self):
-        """Test check_layout() - bad target (too many)"""
-        self.set_test_snap_yaml(
-            "layout",
-            {
-                "/a/1": {"bind": "$SNAP/1"},
-                "/a/2": {"bind": "$SNAP/2"},
-                "/a/3": {"bind": "$SNAP/3"},
-                "/a/4": {"bind": "$SNAP/4"},
-                "/a/5": {"bind": "$SNAP/5"},
-                "/a/6": {"bind": "$SNAP/6"},
-                "/a/7": {"bind": "$SNAP/7"},
-                "/a/8": {"bind": "$SNAP/8"},
-                "/a/9": {"bind": "$SNAP/9"},
-                "/a/10": {"bind": "$SNAP/10"},
-                "/a/11": {"bind": "$SNAP/11"},
-                "/a/12": {"bind": "$SNAP/12"},
-                "/a/13": {"bind": "$SNAP/13"},
-                "/a/14": {"bind": "$SNAP/14"},
-                "/a/15": {"bind": "$SNAP/15"},
-                "/a/16": {"bind": "$SNAP/16"},
-                "/a/17": {"bind": "$SNAP/17"},
-                "/a/18": {"bind": "$SNAP/19"},
-                "/a/19": {"bind": "$SNAP/19"},
-                "/a/20": {"bind": "$SNAP/20"},
-                "/a/21": {"bind": "$SNAP/21"},
-                "/a/22": {"bind": "$SNAP/22"},
-                "/a/23": {"bind": "$SNAP/23"},
-                "/a/24": {"bind": "$SNAP/24"},
-                "/a/25": {"bind": "$SNAP/25"},
-                "/a/26": {"bind": "$SNAP/26"},
-                "/a/27": {"bind": "$SNAP/27"},
-                "/a/28": {"bind": "$SNAP/28"},
-                "/a/29": {"bind": "$SNAP/29"},
-                "/a/30": {"bind": "$SNAP/30"},
-                "/a/31": {"bind": "$SNAP/31"},
-                "/a/32": {"bind": "$SNAP/32"},
-                "/a/33": {"bind": "$SNAP/33"},
-                "/a/34": {"bind": "$SNAP/34"},
-                "/a/35": {"bind": "$SNAP/35"},
-                "/a/36": {"bind": "$SNAP/36"},
-                "/a/37": {"bind": "$SNAP/37"},
-                "/a/38": {"bind": "$SNAP/38"},
-                "/a/39": {"bind": "$SNAP/39"},
-                "/a/40": {"bind": "$SNAP/40"},
-                "/a/41": {"bind": "$SNAP/41"},
-                "/a/42": {"bind": "$SNAP/42"},
-                "/a/43": {"bind": "$SNAP/43"},
-                "/a/44": {"bind": "$SNAP/44"},
-                "/a/45": {"bind": "$SNAP/45"},
-                "/a/46": {"bind": "$SNAP/46"},
-                "/a/47": {"bind": "$SNAP/47"},
-                "/a/48": {"bind": "$SNAP/48"},
-                "/a/49": {"bind": "$SNAP/49"},
-                "/a/50": {"bind": "$SNAP/50"},
-                "/a/51": {"bind": "$SNAP/51"},
-                "/a/52": {"bind": "$SNAP/52"},
-                "/a/53": {"bind": "$SNAP/53"},
-                "/a/54": {"bind": "$SNAP/54"},
-                "/a/55": {"bind": "$SNAP/55"},
-                "/a/56": {"bind": "$SNAP/56"},
-                "/a/57": {"bind": "$SNAP/57"},
-                "/a/58": {"bind": "$SNAP/58"},
-                "/a/59": {"bind": "$SNAP/59"},
-                "/a/60": {"bind": "$SNAP/60"},
-                "/a/61": {"bind": "$SNAP/61"},
-                "/a/62": {"bind": "$SNAP/62"},
-                "/a/63": {"bind": "$SNAP/63"},
-                "/a/64": {"bind": "$SNAP/64"},
-                "/a/65": {"bind": "$SNAP/65"},
-                "/a/66": {"bind": "$SNAP/66"},
-                "/a/67": {"bind": "$SNAP/67"},
-                "/a/68": {"bind": "$SNAP/68"},
-                "/a/69": {"bind": "$SNAP/69"},
-                "/a/70": {"bind": "$SNAP/70"},
-                "/a/71": {"bind": "$SNAP/71"},
-                "/a/72": {"bind": "$SNAP/72"},
-                "/a/73": {"bind": "$SNAP/73"},
-                "/a/74": {"bind": "$SNAP/74"},
-                "/a/75": {"bind": "$SNAP/75"},
-                "/a/76": {"bind": "$SNAP/76"},
-                "/a/77": {"bind": "$SNAP/77"},
-                "/a/78": {"bind": "$SNAP/78"},
-                "/a/79": {"bind": "$SNAP/79"},
-                "/a/80": {"bind": "$SNAP/80"},
-                "/a/81": {"bind": "$SNAP/81"},
-                "/a/82": {"bind": "$SNAP/82"},
-                "/a/83": {"bind": "$SNAP/83"},
-                "/a/84": {"bind": "$SNAP/84"},
-                "/a/85": {"bind": "$SNAP/85"},
-                "/a/86": {"bind": "$SNAP/86"},
-                "/a/87": {"bind": "$SNAP/87"},
-                "/a/88": {"bind": "$SNAP/88"},
-                "/a/89": {"bind": "$SNAP/89"},
-                "/a/90": {"bind": "$SNAP/90"},
-                "/a/91": {"bind": "$SNAP/91"},
-                "/a/92": {"bind": "$SNAP/92"},
-                "/a/93": {"bind": "$SNAP/93"},
-                "/a/94": {"bind": "$SNAP/94"},
-                "/a/95": {"bind": "$SNAP/95"},
-                "/a/96": {"bind": "$SNAP/96"},
-                "/a/97": {"bind": "$SNAP/97"},
-                "/a/98": {"bind": "$SNAP/98"},
-                "/a/99": {"bind": "$SNAP/99"},
-                "/a/100": {"bind": "$SNAP/100"},
-                "/a/101": {"bind": "$SNAP/101"},
-            },
-        )
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_target_bad(self):
-        """Test check_layout() - bad target (normpath)"""
-        self.set_test_snap_yaml(
-            "layout", {"/etc/../demo": {"bind": "$SNAP_COMMON/etc/demo"}}
-        )
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_target_bad_prefix(self):
-        """Test check_layout() - bad target (prefix)"""
-        for prefix in [
-            "/proc/cmdline",
-            "/lib/firmware/foo",
-            "/usr/lib/firmware",
-            "/run",
-            "/var/run",
-        ]:
-            self.set_test_snap_yaml("layout", {prefix: {"bind": "$SNAP/etc/demo"}})
-            c = SnapReviewLint(SnapContainer(self.test_name))
-            c.check_layout()
-            r = c.review_report
-            expected_counts = {"info": None, "warn": 0, "error": 1}
-            self.check_results(r, expected_counts)
-
-    def test_check_layout_source_bad_prefix(self):
-        """Test check_layout() - bad source (prefix)"""
-        self.set_test_snap_yaml("layout", {"/etc/demo": {"bind": "/bad/etc/demo"}})
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_source_bad_prefix_home(self):
-        """Test check_layout() - bad source (prefix $HOME)"""
-        self.set_test_snap_yaml(
-            "layout", {"/var/tmp/other": {"bind": "$HOME/snap/other"}}
-        )
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_source_bad_val(self):
-        """Test check_layout() - bad source (list)"""
-        self.set_test_snap_yaml("layout", {"/etc/demo": {"bind": []}})
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_source_bad(self):
-        """Test check_layout() - bad source (normpath)"""
-        self.set_test_snap_yaml(
-            "layout", {"/etc/demo": {"bind": "$SNAP_COMMON/etc/../demo"}}
-        )
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_source_bad_type(self):
-        """Test check_layout() - bad source (type)"""
-        self.set_test_snap_yaml(
-            "layout", {"/etc/demo": {"nonexistent": "$SNAP_COMMON/etc/demo"}}
-        )
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_mode_bad(self):
-        """Test check_layout() - mode bad"""
-        self.set_test_snap_yaml(
-            "layout", {"/var/lib/foo": {"type": "tmpfs", "mode": []}}
-        )
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_mode_range(self):
-        """Test check_layout() - mode range"""
-        self.set_test_snap_yaml(
-            "layout",
-            {
-                "/var/lib/foo": {"type": "tmpfs", "mode": 0},
-                "/var/lib/bar": {"type": "tmpfs", "mode": "778"},
-            },
-        )
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 2}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_type_bad(self):
-        """Test check_layout() - type bad"""
-        self.set_test_snap_yaml("layout", {"/var/lib/foo": {"type": []}})
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_type_nonexistent(self):
-        """Test check_layout() - type nonexistent"""
-        self.set_test_snap_yaml("layout", {"/var/lib/foo": {"type": "nonexistent"}})
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_user_bad(self):
-        """Test check_layout() - user bad"""
-        self.set_test_snap_yaml("layout", {"/var/lib/foo": {"user": []}})
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_user_invalid(self):
-        """Test check_layout() - user invalid"""
-        self.set_test_snap_yaml("layout", {"/var/lib/foo": {"user": "0"}})
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
-    def test_check_layout_group_bad(self):
-        """Test check_layout() - group bad"""
-        self.set_test_snap_yaml("layout", {"/var/lib/foo": {"group": []}})
-        c = SnapReviewLint(SnapContainer(self.test_name))
-        c.check_layout()
-        r = c.review_report
-        expected_counts = {"info": None, "warn": 0, "error": 1}
-        self.check_results(r, expected_counts)
-
     def test_check_apps_install_mode(self):
         """Test check_apps_install_mode()"""
         self.set_test_snap_yaml("apps", {"foo": {"install-mode": "enable"}})
diff --git a/tests/test.sh.expected b/tests/test.sh.expected
index 7e394ec..e74cc2c 100644
--- a/tests/test.sh.expected
+++ b/tests/test.sh.expected
@@ -4852,18 +4852,6 @@ nix-example-jormungandr_f7xva0vh9fzv20vhyr121yd6ahplqh9v_amd64.snap: pass
       "manual_review": false,
       "text": "OK"
     },
-    "lint-snap-v2:layout": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_source:/nix:$SNAP/nix": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_target:/nix": {
-      "manual_review": false,
-      "text": "OK"
-    },
     "lint-snap-v2:snap_type_redflag": {
       "manual_review": false,
       "text": "OK"
@@ -5015,18 +5003,6 @@ nix-example-jormungandr_f7xva0vh9fzv20vhyr121yd6ahplqh9v_amd64.snap: pass
         "manual_review": false,
         "text": "OK"
       },
-      "lint-snap-v2:layout": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_source:/nix:$SNAP/nix": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_target:/nix": {
-        "manual_review": false,
-        "text": "OK"
-      },
       "lint-snap-v2:snap_type_redflag": {
         "manual_review": false,
         "text": "OK"
@@ -5268,18 +5244,6 @@ nix-example_g7qmi8r4qwws6fhwschfb8aib5wl0x1q_amd64.snap: pass
       "manual_review": false,
       "text": "OK"
     },
-    "lint-snap-v2:layout": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_source:/nix:$SNAP/nix": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_target:/nix": {
-      "manual_review": false,
-      "text": "OK"
-    },
     "lint-snap-v2:meta_gui_desktop": {
       "manual_review": false,
       "text": "desktop interfaces (x11) specified without a corresponding meta/gui/*.desktop file. If your application does not require a desktop file, you may ignore this. Otherwise, if using snapcraft, please see https://snapcraft.io/docs/build-snaps/metadata#fixed-assets or provide a desktop file in meta/gui/*.desktop (it should reference one of the 'apps' from your snapcraft/snap.yaml)."
@@ -5516,18 +5480,6 @@ nix-example_g7qmi8r4qwws6fhwschfb8aib5wl0x1q_amd64.snap: pass
         "manual_review": false,
         "text": "OK"
       },
-      "lint-snap-v2:layout": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_source:/nix:$SNAP/nix": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_target:/nix": {
-        "manual_review": false,
-        "text": "OK"
-      },
       "lint-snap-v2:meta_gui_desktop": {
         "manual_review": false,
         "text": "desktop interfaces (x11) specified without a corresponding meta/gui/*.desktop file. If your application does not require a desktop file, you may ignore this. Otherwise, if using snapcraft, please see https://snapcraft.io/docs/build-snaps/metadata#fixed-assets or provide a desktop file in meta/gui/*.desktop (it should reference one of the 'apps' from your snapcraft/snap.yaml)."
@@ -35331,78 +35283,6 @@ test-snapd-layout_1.0_all.snap: pass
       "manual_review": false,
       "text": "OK"
     },
-    "lint-snap-v2:layout": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout:/opt/foo:mode": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout:/opt/foo:type": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_source:/etc/demo.cfg:$SNAP_COMMON/etc/demo.conf": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_source:/etc/demo.conf:$SNAP_COMMON/etc/demo.conf": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_source:/etc/demo:$SNAP_COMMON/etc/demo": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_source:/opt/demo:$SNAP/opt/demo": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_source:/usr/share/demo:$SNAP/usr/share/demo": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_source:/var/cache/demo:$SNAP_DATA/var/cache/demo": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_source:/var/lib/demo:$SNAP_DATA/var/lib/demo": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_target:/etc/demo": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_target:/etc/demo.cfg": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_target:/etc/demo.conf": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_target:/opt/demo": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_target:/opt/foo": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_target:/usr/share/demo": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_target:/var/cache/demo": {
-      "manual_review": false,
-      "text": "OK"
-    },
-    "lint-snap-v2:layout_target:/var/lib/demo": {
-      "manual_review": false,
-      "text": "OK"
-    },
     "lint-snap-v2:snap_type_redflag": {
       "manual_review": false,
       "text": "OK"
@@ -35522,78 +35402,6 @@ test-snapd-layout_1.0_all.snap: pass
         "manual_review": false,
         "text": "OK"
       },
-      "lint-snap-v2:layout": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout:/opt/foo:mode": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout:/opt/foo:type": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_source:/etc/demo.cfg:$SNAP_COMMON/etc/demo.conf": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_source:/etc/demo.conf:$SNAP_COMMON/etc/demo.conf": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_source:/etc/demo:$SNAP_COMMON/etc/demo": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_source:/opt/demo:$SNAP/opt/demo": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_source:/usr/share/demo:$SNAP/usr/share/demo": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_source:/var/cache/demo:$SNAP_DATA/var/cache/demo": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_source:/var/lib/demo:$SNAP_DATA/var/lib/demo": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_target:/etc/demo": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_target:/etc/demo.cfg": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_target:/etc/demo.conf": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_target:/opt/demo": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_target:/opt/foo": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_target:/usr/share/demo": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_target:/var/cache/demo": {
-        "manual_review": false,
-        "text": "OK"
-      },
-      "lint-snap-v2:layout_target:/var/lib/demo": {
-        "manual_review": false,
-        "text": "OK"
-      },
       "lint-snap-v2:snap_type_redflag": {
         "manual_review": false,
         "text": "OK"